I've been directed to extend our Veeam implementation so that there is a copy that is immutable, in case a hacker gains access to our network they can't mess with the backups. Is there a way to do this that doesn't include physical tape? I like the thought of AWS VTL but it doesn't look like it is truly immutable.

As a related question what if I just copy my VBKs and VIBs up to an Amazon bucket and make it immutable myself? Is that a bad idea? Just throwing things at the wall at this point. Please let me know what you think !